Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/25/2019
07:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Email Threats Continue to Grow as Attackers Evolve, Innovate

Threat actors increasingly using malicious URLs, HTTPS domains, file-sharing sites in email attacks, FireEye says.

Email continues to be an extremely effective vector for delivering malicious content because of how adept attackers have become at tricking users over the years.

The latest examples include the increasing use of malicious URLs in emails rather than attachments, a trend toward use of HTTPS domains for hosting malicious sites, and new variants of impersonation fraud.

FireEye recently analyzed a sample set of 1.3 billion emails for the first three months of 2019 and counted more URL-based email attacks than attachment-based ones in the first quarter.

URL attacks involve emails with embedded links pointing to a malware download site or a phishing site designed to steal a user's account credentials or credit card data. Emails containing such links are often harder to detect and block than ones with malicious attachments, according to FireEye.

In many cases, attackers have been embedding such links in emails with very little or no content in them in an attempt to bypass email filters and to try and get the recipient curious enough to click on the link. According to FireEye, there was a spike in the number of content-less emails in January. Sometimes the emails have contained nonclickable URLs that are activated when a user copies and pastes it into a browser, the vendor noted.

FireEye observed a troubling 26% quarter-over-quarter increase in malicious URLs pointing to phishing sites hosted on HTTPS domains. The sites, and the phishing lures to get users there, often spoofed major brands. In fact, in Q1 2019, FireEye observed a 17% quarter-over-quarter increase in phishing attacks involving the misuse of a well-known brand name.

Microsoft was by far the most spoofed brand, accounting for 30% of all detections in the first quarter. Other frequently spoofed brands included Apple, Amazon, PayPal, and OneDrive.

"The increase in phishing sites using HTTPS was a very interesting shift," says Ken Bagnall, vice president of email security at FireEye. Also significant was the number of phishing sites spoofed to appear like different Microsoft login pages that FireEye observed in the first quarter. "This really highlights how useful attackers see getting access to a victim's Office 365 credentials," Bagnall says.

Exploiting Trust in File-Sharing Sites
Also increasing significantly in the first quarter was the number of URL links pointing to malicious files hosted on widely trusted cloud-hosted file sharing sites, such as Dropbox, OneDrive, Google Drive, and WeTransfer. Threat actors are increasingly using such file-sharing services to host malicious content because the sites pass the domain reputation checks that many security tools use for vetting links, FireEye said.

Some of these file-sharing sites even let users preview the hosted content and offer a link that can be clicked without having to download the file, the vendor said. "Attackers are simulating user behavior here," Bagnall notes. File-sharing sites have become very common, so users are likely to be less suspicious of interacting with content on these services. "There was a very significant increase in OneDrive this quarter, and we will see more targeting based on customers usage of cloud services in their workflow," he says.

Impersonation email attacks, where an attacker might pretend to be a CEO or a CFO to trick employees into initiating a fraudulent wire transfer or some other action, continued to grow and evolve in the first quarter. In the past, such attacks targeted employees in the accounts payable department. In this year's first quarter, FireEye observed an increase in attacks targeting the payroll and supply chain departments.

For organizations, such developments highlight the need for multilayered defenses. On the technology front, they need a tool stack that innovates in line with attacker behavior, Bagnall says. Security awareness training and education are important as well. So are controls that protect payments processes and prevent individuals in an organization to change bank details or initiate similar actions based on an email communication alone, he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...